Zetsu

Inspired by https://github.com/Cracked5pider/Stardust.

What can i do with this

This template allows to compile shellcode, while allowing for:

• Easy dll and function resolving
• Compile time hashing
• The usage of string literals

How to use

In order to compile use:

make

# This can be ignored
x86_64-w64-mingw32-ld: bin/shellcode.exe:.text: section below image base

The binary file can be retrieved from the bin folder.

Load library

In order to load a library this can be used:

// Assuming the library may not already be in memory
uintptr_t user32_base = resolver::find_module(W_HASH(L"user32.dll"), "user32.dll");

// Assuming the library is already in memory
uintptr_t kernel32_base = resolver::find_module(W_HASH(L"kernel32.dll"), NULL);

Resolving functions

In order to resolve a function:

Define the function prototype in the api.h file:

namespace api
{
    using LoadLibraryA_t = HMODULE(WINAPI *)(LPCSTR);
    using MessageBoxA_t = int(WINAPI *)(HWND, LPCSTR, LPCSTR, UINT);
    using ExitProcess_t = void(WINAPI *)(UINT);
}

Load it from the library:

auto pMessageBoxA = resolver::get_api<api::MessageBoxA_t>(user32_base, C_HASH("MessageBoxA"));

In both library and function loading make sure to check if the return value is != 0

Using string literals

String literals can be used normally:

const char *message = "C++ shellcode is running!";
const char *caption = "Success!";

// Using the function resolved from above
pMessageBoxA(NULL, message, caption, MB_OK | MB_ICONINFORMATION);